IIS Failed Request Tracing

• Author
• Recent Posts

Surender Kumar

Surender Kumar has more than twelve years of experience in server and network administration. His fields of interest are Windows Servers, Active Directory, PowerShell, web servers, networking, Linux, virtualization, and penetration testing. He loves writing for his blog.

Latest posts by Surender Kumar (see all)

• Using the QCOW2 disk format in Proxmox - Tue, Jun 6 2023
• Dacpac and Bacpac in SQL Server - Tue, May 30 2023
• Proxmox Backup Server: Install and configure - Fri, May 19 2023

By using failed request tracing, you could add rules based on the HTTP status codes (e.g., 500 or 403) and when the status code is reproduced, the entire request will be logged in a file so that you could diagnose the problem.

Install Tracing Feature using PowerShell

The failed request tracing is a feature that is available under web server role. To determine if this feature is installed or not, you can run the following PowerShell command:

Get-WindowsFeature -Name Web-Http-Tracing

Checking the install status of failed request tracing using PowerShell

If you see the Install State as Available, it means the feature is not currently installed. To install it, run the following command:

Get-WindowsFeature -Name Web-Http-Tracing | Install-WindowsFeature

Installing failed request tracing feature using PowerShell

Install Tracing Feature using Server Manager

If you want to install the failed request tracing feature using Server Manager, follow these steps:

1. Launch Server Manager
2. In Server Manager, click on Manage à Add Roles and Features
3. Click Next. On Installation Type page, select Role-based or feature-based installation radio button, and click Next
4. In Server Selection, select your web server and click Next
5. On Server Roles page, expand Web Server (IIS) à expand Web Server à expand Health and Diagnostics à select the checkbox against Tracing, click Next twice and finally click on Install.

Installing failed request tracing feature using Server Manager GUI

Enable Failed Request Tracing rules

Once you enable the failed request tracing feature, whenever you face any problem in your website, you need to enable the failed request tracing rules. If you can directly access the web server using remote desktop, you could simply use IIS Manager to add the tracing rules. If you cannot access your server (e.g., if it is shared hosting server), you could still add failed request tracing rules using web.config file (of course, if your hosting provider supports it).

Enable Failed Request Tracing using IIS Manager

1. To enable failed request tracing rules using IIS Manager, follow these steps:
2. Open IIS Manager
3. In the IIS Manager, expand the Server node à expand Sites node à and then select the website you want to enable the failed request tracing for.
4. In Features View under IIS section, double click on Failed Request Tracing Rules.

Failed Request Tracing Rules option in IIS Manager

5. Now click on Edit Site Tracing link in Actions pane in the right

Enabling failed request tracing rules using IIS Manager

6. Select the Enable checkbox to activate the failed request tracing feature for the selected website. Here you can customize the directory to store trace log files and limit the number of log files. Since failed request tracing feature is resource intensive, it is recommended to turn it off when you are done troubleshooting. Just uncheck the checkbox to disable the failed request tracing feature.
7. By default, this will not do anything on its own. You need to create tracing rules and define when to capture the trace logs. To create a rule, click on Add link in the Actions pane in right.

Add failed request tracing rule specify content to trace

8. Select the appropriate radio button to only trace a certain type of pages. To trace everything, just select the All Content option and click Next.
9. Now define the trace conditions by specifying HTTP status codes in Status code(s) field that you want to trace. It depends upon the type of problem you are trying to replicate. If users are reporting permissions related problem, you need to trace the 403-status code. To trace the server related errors, you could trace 500-status code. If you are unsure at this stage, you could specify a range of status codes like 400-403. You could even specify the multiple ranges like 400-403,500-505. Please remember the higher status code range you specify here, the more intensive the tracing logs will be generated, and it will become hard to analyse all the logs. So, you need to type the status codes wisely.
10. If you’re diagnosing the application performance issues like slow requests, you can also check the box against Time taken and then type the time in seconds. To further narrow down the logging, you could select the Event severity checkbox and select Error, Critical Error or Waning events only. Now click Next.

Add failed request tracing rule define trace conditions

12. Now you need to select the Trace Providers. If you are not sure about it, leave everything checked and click on Finish.

Add failed request tracing rule select trace providers

13. That’s it. The failed request tracing is now enabled on your server for a particular website. Now try to replicate the issue in website. When the issue is replicated, the trace logs will be captured in the specified directory. By default, the trace logs are stored in %SystemDrive%\inetpub\logs\FailedReqLogFiles
14. If you have multiple websites on the web server, you will see multiple folders with a name that begins with W3SVC and ends with your website ID. To determine the website ID, just click on the Sites node in IIS Manager and your website ID will be listed under ID column as shown in the following screenshot.

Determine website ID using IIS manager

15. Now we know our website ID is 3 so the failed request tracing logs will be available in a directory named Likewise, the website access logs will be available in %SystemDrive%\inetpub\logs\LogFiles inside a directory named W3SVC3
    

Locating failed request tracing logs for a particular website in file explorer

Enable Failed Request Tracing with a command

The following screenshot shows how to enable failed request tracing using command prompt:

Configure failed request tracing on website using cmd

Enable Failed Request Tracing using web.config File

When you do not have permission to use IIS manager as in the Shared hosting environments, you can enable the trace rules using web.config file. The exact failed request tracing rules that we added in previous section using IIS manager can be added using the following code in web.config file.

<tracing>
  <traceFailedRequests>
     <add path="*">
        <traceAreas>
           <add provider="ASP" verbosity="Verbose" />
           <add provider="ASPNET" areas="Infrastructure,Module,Page,AppServices" verbosity="Verbose" />
           <add provider="ISAPI Extension" verbosity="Verbose" />
           <add provider="WWW Server" areas="Authentication,Security,Filter,StaticFile,CGI,Compression,Cache,RequestNotifications,Module,FastCGI,WebSocket" verbosity="Verbose" />
        </traceAreas>
       <failureDefinitions timeTaken="00:00:00" statusCodes="400-403,500-505" />
     </add>
  </traceFailedRequests>
</tracing>

Make sure you add these lines between <system.webServer> and </system.webServer> tags.

Adding failed request tracing rule using web.config file

The modern web hosting control panels like Plesk provides a built-in option where you could define the failed request tracing rules and download the trace log files from within the Plesk web interface itself.

Failed request tracing option in Plesk

Analyse the Failed Request Tracing Logs

When the issue is replicated, the trace logs are captured in the directory as shown in the following screenshot:

Locating and understanding the trace log files in file explorer

The log files are generated in XML format and you can open them in Internet Explorer for better readability. Once you’re done with the log files, you could delete the actual log files but do not delete the freb.xsl file which is the XML stylesheet. If you delete this file, you will lose all the formatting and Internet Explorer won’t be able to properly display the log files.

The following screenshot shows a typical log file opened in Internet Explorer. The entire xml log is divided into Request Summary, Request Details, and Compact View tabs.

Opening and reading the trace logs file using Internet Explorer

The Request Summary tab shows the summary for a request including HTTP status code and sub-status code. It also tells us the module where the warning was generated during the request and the user name from request token. To see the complete request in details, you could click on Request Details or Compact View tab.

Usually, the cause of 403.14 error is either directory browsing is not enabled or default document is not properly configured so the web server displayed a Forbidden error. To resolve this error, make sure that default document is enabled and set. If you want your users to be able to browse the contents of website directory (which is unlikely by the way), you could enable the directory browsing feature.

Viewing default document and directory browsing options in IIS manager

If everything else is correct in server configuration and your website is an MVC (model-view-controller) based, it is worth asking the developer to verify if the default route for home (index) page is properly setup. By default, the MVC application uses ASP.NET Routing. Sometimes, server admins spend a lot of time troubleshooting the issue and, in the end, it tracks down to a small negligence of developer.

That was it for this guide. This was just a simple example to demonstrate how detailed errors and failed request tracing can help you troubleshoot the errors in a website hosted with IIS. These features can help you determine the cause of potential issues in a website.